Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.221 Home All releases ←olderv2.1.220 v2.1.222newer→

Claude Code v2.1.221 3 Aug 2026

MCP OAuth handles the RFC 9207 issuer parameter

You'll notice

Useful3 Signal0

MCP

MCP OAuth logins now verify the issuer and give clearer errors when client registration is rejected.

What

Loopback and manual-URL OAuth callbacks now read iss from the query string and carry it into token exchange, and saved MCP tokens record the issuer.

Details

Token exchange receives authorizationCode: d.code, iss: d.iss.
Saved tokens gain an issuer field; an unexpected-issuer check runs when the authorization server advertises iss support.
New failure classification "dcr_rejected" separates a rejected dynamic client registration from the existing "dcr_failed".
OAuth error matching moved off message and errorCode sniffing onto typed SDK errors read via .code, covering invalid_client, unauthorized_client and InvalidGrant.

Evidence

dcr_rejected

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.221 →